@@ -302,6 +302,8 @@ int unupack(int upack, char *dest, uint32_t dsize, char *buff, uint32_t vma, uin

 			loc_esi += 4;

 			cli_dbgmsg("Upack: ecx counter: %08x\n", j);

+			if (((uint64_t)count+j) * 4 > UINT_MAX)

+				return -1;

 			if (!CLI_ISCONTAINED(dest, dsize, loc_esi, (j*4)) || !CLI_ISCONTAINED(dest, dsize, loc_edi, ((j+count)*4)))

 				return -1;

 			for (;j--; loc_edi+=4, loc_esi+=4)

@@ -359,6 +361,8 @@ int unupack(int upack, char *dest, uint32_t dsize, char *buff, uint32_t vma, uin

 			loc_edi += 4;

 			loc_ebx = loc_edi;

+			if (((uint64_t)count+6) * 4 > UINT_MAX)

+				return -1;

 			if (!CLI_ISCONTAINED(dest, dsize, loc_edi, ((6+count)*4)))

 				return -1;

 			cli_writeint32(loc_edi, 0xffffffff);